Open recursors are a problem. They can be used by attackers to amplify a packet stream to a victim. As such you should only be running a recursor on your internal network and an authoritative server on your interfaces facing the big, bad Internet.
You can run BIND9 with a split view (also called ‘split brain’), or use my setup: a NSD serving the outside world, and using BIND9 as recursor for your internal network.
I like tweak my prompt and I use zsh, thus I have infinite possibilities :-)
I owe much the phil’s prompt which gave me a lot of ideas.
My prompt is ofcourse in full color, as I’m a fan of that too. (Old UNIX users may shrudder at this point…)
Right now I have a prompt that keeps out of my face, but when needed has some usefull extras; like showing background jobs and showing the exit code of the previous command if it wasn’t equal to zero.
Co-author of RFC 4641 a BCP (Best Current Practice) for DNSSEC operations. This was written together with Olaf Kolkman.
At the time I was employed at NLnet Labs
This RFC gives guidelines on how to setup secure zones in a world with DNSSEC. It also gives pointers for public and private key handling and deals with the key lengths and how to handle key rollovers.
Well, after having used the go’old mbox format, I have now changed my mail
setup to maildir. What a difference. I think the load on my machine
is actual less then before the transition.
I used google (mbox convert maildir) to convert my setup to maildir,
this was all relatively easy. Both postfix and
procmail were “fixed” this way.
After restarting I indeed saw mail being deliverd to my newly created
Maildir directory in my homedir. But I couldn’t read it…
published in 2003
By Paul Wouters (paul@xtdnet.nl)
This article is a translation of the article “Secure DNS, Het beveiligingen van DNS in de praktijk that appeared in C’T magazine on March 14 2003.
The Dutch NIC (SIDN [http://www.domain-registry.nl/]>), The European Regional Internet Registry (RIPE), and NLnetLabs have created the first toplevel secure DNS. The experiment is running its own set of nameservers to guarantee that the experiment will not interfere with the production nameservers. The project started in November of 2002 with the goal of gaining experience in running DNSSEC for a TLD Registry.
This is an older publication (from 2004).
This report gives an outline of the current status of SECREG, the Dutch experiment for introducing DNSSEC in NL.
It is written for SIDN (the people who take care of .nl) and it tries to explain what DNSSEC will mean for a registry.
Downloads are here:
Ik beheer mijn eigen DNS en mijn eigen mail/web server op de computer die ik thuis heb staan; gewoon om te blijven leren hoe zulke zaken in elkaar steken. Ik zal hier vertellen hoe ik een site op heb gezet.
Tis wel ontzettend lang geleden sinds ik dit allemaal opgezet heb, dus ik hoop dat ik het nog juist vertel.
Dit verhaal gaat er vanuit dat je een domein hebt geregistreerd en dat
er een A (address) record met de naam ‘www’ bestaan. Dit address
record heeft het IP adres van jouw host. Ik zal het hier over het
domein miek.nl hebben. Ik ga verder niet in op de details die je
moet regelen omdat voor elkaar te krijgen.
I’ve worked with cfengine in the past and really like it. It really cuts down on management for the systems that used it. For my home network I thought I try something else, that something turned out to be puppet.
I must say that I already like it more than cfengine as you can write much smaller manifests.
I want to centralize the management of the files in /etc and I want to keep track of changes of the file. For the management I’m going with puppet and for the versioning I choose git.
Compare the following:
$ touch -- -x
$ less -- -x
<control-C>
$ more -- -x
more: unknown option "-x"
usage: more [-dflpcsu] [+linenum | +/pattern] name1 name2 ...
WTF? more doesn’t know what “–” means. Okay, time for a patch.
uniq
$ uniq --help
Usage: uniq [OPTION]... [INPUT [OUTPUT]]
Ah, so we support an INPUT file and an OUTPUT file…that’s not really unix like IMHO. And what you suppose does:
Right now I’m installing Ubuntu (gutsy) on some PC. The default install CD from ubuntu forces you to do this in X-window. And it all runs from a live-cd…. It’s slow and not usefull, and looking over my shoulder I see it has crashed in ‘Detecting Filesystems’…. Great.
I also hit an issue where the bottom of the installer program (ubuigity they call it) wasn’t completely visible on the screen, so I couldn’t click the forward buttons. I’m downloading the alternate install CD right now. That at least works quickly and ok.
I’ve made a small plugin which generates a tag cloud for your nb style blog. It’s probably a bit rough aroudn the edges, but it works, as you can see on the right.
You can fetch it here.
I’m using the gallery plugin for the photos on this site. This plugin works great and easy, but there wasn’t an easy way to create a slide show. So that you can click ’next’ and go to the next photo. So I’ve added this functionality to the script.
I’m putting this up for download, so that other people may use this too. gallery.sh If you want to regenerate the slides, you can just remove the html and slides directories.
